Internal audit key performance indicators are the measures a function uses to show its board, its stakeholders and itself that it is doing the job described in its charter. The Global Internal Audit Standards require them: Standard 12.2 says the chief audit executive must develop objectives to evaluate the function’s performance, consider the expectations of the board and senior management when setting them, and measure and report progress against them. Most functions that fail that standard do not fail for lack of numbers. They fail because the numbers they report (hours charged, reports issued, findings raised) measure activity, and the board cannot tell from activity whether risk is being managed better than it was a year ago.
This guide sets out thirty indicators in six groups, each defined with a formula, a data source, a target range and the trap it sets when misused. It explains how to choose a set of eight to twelve rather than reporting all thirty, how to set targets from the function’s strategy under Standard 9.2, how to present them on one page to an audit committee, and what to do when the numbers are bad. It ends with a worked example of a six-person function choosing its first eleven measures after a self-assessment found it had none. The metrics sheet in the QAIP documentation kit is the companion spreadsheet; the audit committee deck template has the slide.
In this guide
- What Standard 12.2 requires, and what it does not
- Six design rules before choosing any metric
- Group 1: coverage (five metrics)
- Group 2: timeliness (five metrics)
- Group 3: quality (five metrics)
- Group 4: impact (six metrics)
- Group 5: stakeholder confidence (four metrics)
- Group 6: capability and efficiency (five metrics)
- Choosing eight to twelve: a selection method
- Setting targets from the strategy
- The one-page audit committee dashboard
- Ten traps, with the metric that springs each one
- What to do when the numbers are bad
- Template: the metric definition card
- Worked example: MidState Beverage chooses its first eleven measures
- Questions about internal audit KPIs
- Related guides
What Standard 12.2 requires, and what it does not
Standard 12.2, Performance Measurement, sits in Domain IV under Principle 12, Enhance Quality. Its requirements are short: the chief audit executive develops objectives to evaluate the function’s performance, considers the input and expectations of the board and senior management when developing them, identifies measures, and measures and reports progress. The considerations for implementation point to the function’s strategy, its plan and its charter as sources of objectives, and to both quantitative and qualitative measures.
Three things the standard does not do. It does not prescribe metrics, so there is no IIA list to copy. It does not require a dashboard, a scorecard or any particular format. And it does not require the measures to be published outside the board and senior management. What it does require is a chain: objectives derived from the strategy and stakeholder expectations, measures tied to those objectives, and reporting of progress. An external assessor testing 12.2 will ask to see the chain, not the chart. The Domain IV guide covers the standard in context; the QAIP playbook covers where performance measurement sits inside the quality program.
| Standard 12.2 element | What satisfies it | What does not |
|---|---|---|
| Objectives for the function’s performance | Five to eight statements derived from the strategy (“complete the approved plan”, “findings are acted on”, “stakeholders rate the function as useful”) | A list of metrics with no objective above them |
| Board and senior management input | Minutes or a memo showing the audit committee chair and the CEO or CFO were asked what they expect the function to achieve | Metrics chosen by the CAE alone |
| Measures | Each objective has one to three measures with a definition, a source and a target | Measures that cannot be reproduced from a data source |
| Measurement and reporting | Progress reported to the board at least annually, with trend and target | Measures collected and never reported |
Six design rules before choosing any metric
- Every metric proves something a stakeholder cares about. If the audit committee chair would not change a decision because the number moved, drop it.
- Outcomes outrank outputs, outputs outrank inputs. Risk reduced (outcome) beats reports issued (output) beats hours charged (input). A balanced set has at least one of each, weighted toward outcomes.
- Each metric has one definition, one owner and one source. “Plan completion” means the same thing in every quarter; the audit manager owns it; the audit management system or the plan tracker produces it.
- Targets come from the strategy, not from last year plus five percent. If the strategy says the function will shift to 25 percent advisory work, the advisory-share metric’s target is 25, whatever last year’s number was.
- Pair every metric with its trap. Plan completion can be gamed by shrinking the plan; findings per audit by splitting findings; stakeholder satisfaction by softening reports. Report the pair, or at least know it.
- Report fewer than twelve. A board page with thirty numbers is not read. Keep the full set for management; show the board the eight to twelve that map to its expectations.
Group 1: coverage (five metrics)
Coverage metrics answer the board’s first question: is the function looking at the right things, and all of them? They draw on the annual risk assessment and the audit plan.
| # | Metric | Formula | Source | Target range | The trap |
|---|---|---|---|---|---|
| 1 | Plan completion | Engagements completed (final report issued) ÷ engagements in the approved plan, including approved changes | Plan tracker; audit management system | 85 to 95 percent; 100 percent is suspicious | Shrinking or re-baselining the plan mid-year; report changes separately (metric 4) |
| 2 | High-risk universe coverage | High-risk auditable entities audited in the cycle ÷ high-risk entities in the universe | Audit universe with risk ratings | 100 percent within the cycle the strategy sets (often 1 to 2 years for high) | Re-rating entities down so they fall out of the numerator’s denominator |
| 3 | Strategic objective coverage | Strategic objectives with at least one engagement addressing a risk to them ÷ strategic objectives | Plan mapped to objectives (the Domain I test) | 100 percent over the cycle | Mapping every audit to every objective; require a stated risk link |
| 4 | Plan change rate | (Engagements added + removed + deferred) ÷ engagements in the original plan | Plan change log with board approvals (Standard 9.4) | 10 to 25 percent; near zero means the plan is not responding to risk; above 40 percent means it was wrong | Treating changes as failures; the board should see why each changed |
| 5 | Assurance share and advisory share | Hours on assurance ÷ total engagement hours; same for advisory | Time records (myDayLog or the audit system) | Whatever the strategy sets; commonly 65 to 80 percent assurance | Reclassifying work to hit the target; define the two services in the charter |
Group 2: timeliness (five metrics)
Timeliness metrics measure whether assurance arrives while it is still useful. A finding reported four months after fieldwork describes a control environment that no longer exists. The how long an audit takes guide gives benchmarks by engagement type.
| # | Metric | Formula | Source | Target range | The trap |
|---|---|---|---|---|---|
| 6 | Fieldwork-to-draft days | Calendar days from last day of fieldwork to draft report issued, median across engagements | Engagement dates in the audit system | 10 to 20 days | Issuing a draft with open findings to stop the clock; define “draft” as complete |
| 7 | Draft-to-final days | Days from draft to final report, median | Same | 15 to 30 days; longer usually means management responses are late (metric 8) | Blaming management without a response deadline in the protocol (evaluating management responses) |
| 8 | Management response within deadline | Responses received by the agreed date ÷ responses requested | Issue log | 80 percent or better | Setting deadlines nobody enforces; escalate at day plus seven |
| 9 | Budget variance | (Actual hours minus budgeted hours) ÷ budgeted hours, by engagement and in aggregate | Time records against the planning memo budget | Within plus or minus 15 percent on most engagements | Padding budgets to stay under; track the estimate’s own accuracy over time |
| 10 | Elapsed time per engagement | Calendar days from kickoff to final report, median, by engagement type | Engagement dates | Process audit 60 to 90 days; IT audit 75 to 110; investigation varies | Running six engagements at once to hit utilization, which stretches every one of them |
Group 3: quality (five metrics)
Quality metrics come from the function’s own quality program (Standard 8.3 and Principle 12) and from the people who read its work. They are the ones an external assessor will look at hardest, because they show whether the function knows its own weaknesses.
| # | Metric | Formula | Source | Target range | The trap |
|---|---|---|---|---|---|
| 11 | Internal quality review score | Engagements meeting all checklist criteria on the post-engagement review ÷ engagements reviewed | QAIP engagement reviews (kit) | 85 percent or better; trend matters more than level | Reviewers who report to the engagement manager; rotate the reviewer |
| 12 | Review notes per engagement | Review notes raised ÷ engagements, with the share cleared within five days | Workpaper system (review notes) | Falling trend; clearance within five days above 90 percent | Suppressing notes to look good; count them as learning, not failure |
| 13 | Findings sustained on challenge | Findings that survived management challenge unchanged or with wording changes only ÷ findings challenged | Issue log with challenge field (negotiating findings) | 85 percent or better | Never being challenged, which usually means findings are too soft to argue with |
| 14 | Conformance with the Standards | Result of the internal self-assessment (Standard 8.3) and the external assessment (8.4): conforms, partially conforms, does not conform, by standard | QAIP records | No “does not conform”; partial conformances with dated action plans | A self-assessment that never finds anything; the first honest one usually finds three to six partials |
| 15 | Report readability | Executive summary word count and reading level (for example, Flesch-Kincaid grade) sampled quarterly | Report files (executive summary) | Summary under 400 words; grade 10 to 12 | Measuring the summary and ignoring the body; readers stop at the summary anyway |
Group 4: impact (six metrics)
Impact metrics are the outcomes. They are harder to collect and the only ones that answer the question Domain I poses: did the organization’s ability to create, protect and sustain value improve? They rely on a disciplined issue log, which the issue log template describes field by field.
| # | Metric | Formula | Source | Target range | The trap |
|---|---|---|---|---|---|
| 16 | Actions implemented on time | Agreed actions closed by the original target date ÷ actions due in the period | Issue log | 75 to 90 percent; High-rated actions tracked separately | Date extensions granted freely; count extensions as misses unless the board approved them |
| 17 | Past-due actions, aged | Open actions past target date, bucketed 1 to 90 days, 91 to 180, over 180, with High separated | Issue log | Zero High-rated actions over 90 days past due without board escalation (Standard 15.2 and 11.5) | Reporting a count without an age; a count hides the two-year-old finding |
| 18 | Validated closure rate | Actions closed after internal audit validation ÷ actions closed; and the share re-opened on validation | Issue log (issue validation) | 100 percent of High and Medium validated; re-open rate under 10 percent | Accepting management’s “closed” without testing; the re-open rate is the honesty check |
| 19 | Repeat findings | Findings in the period whose root cause matches a finding closed in the previous three years ÷ findings in the period | Issue log with root cause field (root cause analysis) | Under 10 percent | Writing root causes so vaguely that nothing ever repeats on paper |
| 20 | Quantified value | Sum of recoveries, cost avoided and losses prevented that management has agreed to in writing, for the period | Engagement records with management sign-off | Report the number with its basis; no target, because chasing it distorts the plan | Counting unverified estimates; only management-agreed figures count |
| 21 | Risk rating movement | Auditable entities whose residual risk rating improved after remediation ÷ entities re-rated in the period; and entities that worsened | Audit universe ratings across cycles | Improving trend; worsening entities named to the board | Re-rating only after audits; the risk assessment should re-rate everything annually |
Group 5: stakeholder confidence (four metrics)
Stakeholder metrics measure whether the people the function serves find it useful. They are qualitative at the source and quantitative in the aggregate, and the standard explicitly allows both. The psychology of auditees guide explains why survey design matters more here than anywhere else.
| # | Metric | Formula | Source | Target range | The trap |
|---|---|---|---|---|---|
| 22 | Post-engagement survey score | Mean score on four or five questions (was the scope right, were findings fair, was the team professional, did the report help you), 1 to 5 scale, sent to the engagement sponsor and the main contact | Survey tool; sent within a week of the final report | 4.0 or better; response rate above 60 percent | Softening findings to protect the score; pair with metric 13 and the finding severity mix |
| 23 | Audit committee assessment of the function | Annual committee evaluation of internal audit, usually a short questionnaire plus discussion in executive session | Committee minutes (audit committee playbook) | Rated effective; specific improvement requests tracked | Treating the discussion as a formality; ask the chair for one thing to change |
| 24 | Requests for advisory work | Advisory requests received from management in the period, and the share the function accepted | Request log | Rising trend in a maturing function | Accepting every request; a function that never declines has become a consultancy |
| 25 | Self-identified issues | Issues management reported to internal audit before an audit found them ÷ total issues logged | Issue log with source field | Rising share; 20 to 40 percent in a mature control environment | Letting self-identification excuse the control failure; it reduces severity, not existence |
Group 6: capability and efficiency (five metrics)
Capability metrics measure whether the function can keep doing the work. Efficiency metrics measure what it costs. Both are inputs, and both belong in the management set more than the board set, with one exception: the board that approves the budget under Domain III should see cost per engagement and utilization once a year.
| # | Metric | Formula | Source | Target range | The trap |
|---|---|---|---|---|---|
| 26 | Productive utilization | Hours on engagements and advisory ÷ available hours (excluding leave, training, administration) | Time records | 65 to 75 percent; above 85 means no training and no quality time | Chasing utilization by cutting training (metric 28) and quality reviews (metric 11) |
| 27 | Certification and competency coverage | Auditors holding a relevant certification ÷ auditors; and competency gaps open against the competency roadmap | HR records; competency matrix (Standard 10.2) | Strategy-set; commonly 60 to 80 percent certified at senior and above | Counting certifications nobody uses; map them to the plan’s needs |
| 28 | Training hours per auditor | Training hours in the period ÷ auditors | Time records | 40 hours a year minimum (the CIA CPE floor); more in technology-heavy plans | Logging webinars nobody watched; require a one-line takeaway per course |
| 29 | Staff retention | Auditors who left in the year ÷ average headcount; regretted leavers separated | HR records | Under 15 percent regretted; some rotation out is healthy (exit opportunities) | Counting planned rotations into the business as losses |
| 30 | Cost per engagement and per audit hour | Total function cost ÷ engagements completed; and ÷ productive hours | Budget and time records (cost of an internal audit) | Benchmark against co-source rates; the point is the trend | Cutting cost by cutting scope; read with metric 2 |
Choosing eight to twelve: a selection method
Thirty metrics is a catalog, not a scorecard. The selection method is to start from stakeholder expectations, as Standard 12.2 requires, and work backward:
- Ask the audit committee chair, the CEO and the CFO one question each: “A year from now, what would make you say internal audit had a good year?” Write the answers down verbatim.
- Turn each answer into an objective. “I want to know the big risks are covered” becomes “high-risk entities are audited within the cycle”. “I want findings fixed” becomes “agreed actions are implemented on time and validated”.
- Attach one or two metrics to each objective from the catalog. Prefer outcomes; include at least one coverage, one timeliness, one quality, one impact and one stakeholder metric so the set is balanced.
- Add the two the function needs for itself: usually utilization and the internal quality score, reported to management rather than the board.
- Write a definition card for each (template below), including the trap and the paired metric.
- Pilot for two quarters before setting targets. The first two readings tell you what normal looks like; targets set before that are guesses.
Setting targets from the strategy
Standard 9.2 requires a strategy for the function with objectives, and 12.2 requires performance objectives; the two should be the same list. Each strategic objective yields a target for one or more metrics, and the target changes as the strategy progresses. The table shows the pattern for a function with five strategic objectives.
| Strategic objective (Standard 9.2) | Metric(s) | Year 1 target | Year 3 target | Why the target moves |
|---|---|---|---|---|
| Technology coverage: audit every critical system within two years | 2 (high-risk coverage, technology subset); 27 (competency) | 50 percent of critical systems; one IT-certified auditor | 100 percent; two certified | Coverage depends on building the competency first |
| Analytics in every process audit | Share of process audits with an analytics component (a custom metric) | 40 percent | 100 percent | Catalogs have to be built (AP, payroll, JE) before they can be run everywhere |
| A quality program that passes an external assessment | 11, 12, 14 | Self-assessment complete; partials with action plans | External assessment: generally conforms | The EQA is the end state; the self-assessment is the path |
| Stakeholder relationships at depot and plant level | 22, 24, 25 | Survey launched; response rate 50 percent | Score 4.2; self-identified issues 25 percent | Trust takes two cycles to show up in self-identification |
| Adoption of the Topical Requirements | Share of in-scope engagements with a documented conformance assessment (custom) | Cyber and third-party assessed | All effective requirements assessed where triggered (Topical Requirements) | Requirements take effect on a schedule through 2027 |
The one-page audit committee dashboard
The committee sees one page a quarter. Each row is a metric the committee asked for; each has the current reading, the prior reading, the target, a one-word status and a one-line comment. No charts are needed for twelve numbers; a trend arrow does the job. The presenting to the audit committee guide covers how to talk to it in the ten minutes available.
| Measure | This quarter | Last quarter | Target | Status | Comment |
|---|---|---|---|---|---|
| Plan completion (year to date) | 64% | 41% | 90% by year end | On track | Two engagements deferred to Q4 with committee approval (acquisition timing) |
| High-risk coverage (cycle) | 88% | 81% | 100% by cycle end | On track | Two high-risk entities scheduled Q1 next year |
| Fieldwork to final report (median days) | 38 | 51 | 45 | Met | Response deadline enforced from Q2 |
| Actions implemented on time | 71% | 66% | 80% | Behind | Six late actions, all depot-level; escalation list attached |
| High-rated actions past due over 90 days | 1 | 3 | 0 | Behind | Immutable backup action; funded in Q3, due Q4 (see accepted-risk log) |
| Validated closure re-open rate | 8% | 14% | Under 10% | Met | Two re-opened: evidence incomplete, not control failure |
| Repeat findings | 12% | 18% | Under 10% | Behind | Both repeats trace to the unintegrated acquisitions |
| Post-engagement survey (1 to 5) | 4.1 | 3.9 | 4.0 | Met | Response rate 67% |
| Self-identified issues share | 19% | 15% | 25% by year 3 | On track | Rising at depots with RCSA facilitation |
| Advisory share of hours | 14% | 11% | 15% | Met | Audit management system selection and the DOT advisory |
| Conformance (self-assessment) | 3 partials | 3 partials | 0 by EQA | On track | 9.4, 12.2, 15.2; action plans dated |
| Productive utilization | 71% | 74% | 65 to 75% | Met | Training week in the quarter |
Ten traps, with the metric that springs each one
| Trap | How it shows | The metric that exposes it |
|---|---|---|
| Reporting activity as achievement | “Fourteen reports, 212 findings, 9,400 hours” and no outcome | Any of 16 to 21; the absence of impact metrics is the tell |
| Plan completion by shrinkage | 100 percent completion of a plan cut in half in Q3 | 4 (plan change rate) reported alongside 1 |
| Findings inflation | One control weakness split into five findings to raise the count | Findings per engagement trend read with 13 (sustained on challenge) |
| Score-chasing | Survey scores rise while severity ratings fall | 22 read with the High and Medium share of findings |
| Extension laundering | Nothing is ever past due because every date is extended | 16 counting extensions as misses; 17 aged |
| Silent reliance | Coverage looks complete because second line work was counted without assessment | 2 with a reliance flag per entity (Standard 9.5) |
| Utilization at the expense of quality | Utilization 88 percent; review notes rising; training falling | 26 read with 12 and 28 |
| Vanity value | “Internal audit delivered $4.2 million of value” with no sign-off | 20 restricted to management-agreed figures |
| Root causes that never repeat | Every root cause is “human error”; repeat rate is zero | 19 with a root cause taxonomy that forbids “human error” as a category |
| Measuring what the system produces, not what matters | The audit management system reports cycle time to the hour and nothing on impact | The selection method: expectations first, then metrics (system selection covers reporting requirements) |
What to do when the numbers are bad
The purpose of measuring is to find out, and a function that reports only green has measured nothing. Three rules for a bad reading. Report it in the quarter it happens, with the cause and the action, rather than waiting for it to improve; a committee that learns of a problem two quarters late has lost confidence in every green on the page. Separate what the function controls from what it does not: late management responses are management’s number, and the committee should see it as such, with the escalation the protocol provides. And distinguish a bad number from a bad metric: if plan completion is 60 percent because the plan was wrong, the fix is the risk assessment, not the metric.
One reading is worth special handling. When the self-assessment under Standard 8.3 finds partial conformance, report it to the committee exactly as found, with the standard number, the gap and the dated action. Functions that conceal partials from their own committee and are then found by an external assessor lose far more than the partial cost them. The EQA preparation guide describes what assessors find most often.
Template: the metric definition card
One card per metric, kept with the QAIP records. It is what makes the metric reproducible and what an assessor will ask for.
Metric: [Actions implemented on time]. Objective served: [Agreed actions are implemented and validated; strategy objective 3]. Definition: [Agreed actions whose validated closure date is on or before the original target date, divided by all actions whose original target date fell in the period. Extensions count as misses unless approved by the audit committee.] Formula and source: [Issue log fields: original_target_date, validated_closure_date, extension_approved_by; computed quarterly by the audit manager]. Target: [80 percent in FY27; 90 percent in FY28]. Reported to: [Audit committee quarterly; executive risk committee monthly]. Paired metric and trap: [Past-due actions aged (17); the trap is extension laundering]. Owner: [Audit manager]. First reported: [Q1 FY27]. Change history: [Definition changed Q3 FY27 to count extensions as misses].
Worked example: MidState Beverage chooses its first eleven measures
MidState Beverage, the three-state drinks distributor with a six-person internal audit function used in examples across this site, ran its first Standards self-assessment in the spring of 2026 while building its quality program. Standard 12.2 was rated partially conformant: the function reported hours, engagements and findings to the audit committee each quarter, but had never set performance objectives, had never asked the committee what it expected, and could not show how any number connected to its strategy. The Domain IV assessment recorded the gap and gave the function until the start of FY28 to fix it.
The chief audit executive asked the committee chair, the CEO and the CFO the one question. The chair wanted to know that the big risks were covered and that nothing High-rated sat past due without her knowing; the CEO wanted findings fixed and wanted the depots to stop seeing audit as an inspection; the CFO wanted the plan delivered within budget and wanted to know the audit management system the function was buying would pay for itself in cycle time. Those answers became five objectives, each already present in the strategy’s section 4, and the function chose eleven measures: plan completion with the change rate beside it, high-risk coverage, median fieldwork-to-final days, actions implemented on time with the aged past-due count, validated closure re-open rate, repeat findings, the post-engagement survey, the self-identified issues share, advisory share and the self-assessment conformance count, with utilization reported to management only. Two quarters of readings were collected before targets were set; the plan completion target was set at 90 percent after the FY26 reading showed 10 of 11 planned engagements completed, and the repeat-finding target at under 10 percent after the first reading came in at 18, with both repeats traced to the two acquired distributors whose controls had never been integrated.
| Objective (from the strategy) | Expectation it came from | Measures chosen | FY26 baseline | FY28 target |
|---|---|---|---|---|
| Deliver the approved plan | CFO | 1 plan completion; 4 change rate; 9 budget variance | 91%; 27%; +9% | 90%; under 20%; within 10% |
| Cover the significant risks | Chair | 2 high-risk coverage; 17 High actions past due over 90 days | 81%; 3 | 100%; 0 |
| Findings get fixed | CEO, chair | 16 on time; 18 re-open rate; 19 repeats | 66%; 14%; 18% | 85%; under 10%; under 10% |
| Depots see audit as useful | CEO | 22 survey; 25 self-identified share | 3.9; 15% | 4.2; 25% |
| A quality program that passes the EQA | Chair | 14 conformance; 11 internal review score (management only) | 3 partials; not measured | 0 partials; 85% |
The dashboard in the section above is MidState’s third-quarter FY27 page. The committee chair’s reaction to the first one was the point of the exercise: she asked why the immutable-backup action was still open, which was the question the function had been unable to get asked for two quarters, and the action was funded within the month.
Questions about internal audit KPIs
How many KPIs should an internal audit function report to the audit committee?
Eight to twelve, on one page, each tied to something the committee said it expects. Keep a fuller set for management. A committee page with thirty numbers is not read.
Does the IIA publish a required list of metrics?
No. Standard 12.2 requires performance objectives, stakeholder input, measures and reporting, but leaves the choice of measures to the chief audit executive. Earlier IIA research on measuring internal audit value lists commonly used metrics, but none is mandatory.
What is the single most useful internal audit KPI?
Actions implemented on time, with its aged past-due companion. It measures whether the function’s work changes anything, it is reproducible from the issue log, and its trap (extension laundering) is easy to guard against by counting extensions as misses.
Should internal audit measure the value it adds in money?
Report it when management has agreed the figure in writing (recoveries, avoided costs), and never set a target for it. A target turns the plan toward recoverable findings and away from governance and control work that has no dollar figure.
How often should KPIs be reported?
Quarterly to the audit committee, monthly to the function’s own management meeting, and annually in the board report with the year’s trend and the next year’s targets. Standard 12.2 requires reporting of progress but sets no frequency.
Can a one-person function do this?
Yes, with five measures: plan completion, actions implemented on time, past-due actions aged, a two-question survey and the self-assessment result. The issue log and a time record are the only data sources needed; myDayLog covers the time record for free.
What do external assessors look for under Standard 12.2?
The chain: objectives derived from the strategy and from documented stakeholder input, measures with definitions and sources, and evidence that progress was reported to the board. A dashboard without the chain behind it is rated partial.
Related guides
- The QAIP documentation kit — the self-assessment workbook and the quality metrics sheet.
- Building a QAIP from scratch — where performance measurement sits in the quality program.
- GIAS Domain IV: Managing the function — Standards 9.2 and 12.2 in context.
- The CAE’s audit committee deck template — the slide the dashboard goes on.
- Presenting to the audit committee — delivering the page in ten minutes.
- The finding and issue log template — the data source for every impact metric.
- Issue validation in internal audit — the validated closure rate explained.
- Root cause analysis for audit findings — making the repeat-finding metric honest.
- The annual internal audit risk assessment — the source of coverage metrics.
- How to build an internal audit plan — plan completion and change rate.
- How long does an internal audit take? — benchmarks for the timeliness metrics.
- Evaluating management responses — the response deadline behind metric 8.
- Negotiating audit findings — the findings-sustained metric.
- Preparing for an external quality assessment — what assessors test under 12.2.
- How much does an internal audit cost? — cost per engagement benchmarks.
- A certification roadmap by career stage — the competency metric’s reference.
- What is a chief audit executive — the role, the reporting lines, the first year.
- The audit committee annual agenda — the quarter-by-quarter calendar.
- The internal audit methodology manual — the function’s own rulebook.
- Designing a KRI Program: Selection, Thresholds, Escalation — turning a metric wishlist into an early warning system with thresholds that trigger action
- Reporting to the Audit Committee: The Quarterly Pack — the written quarterly pack that answers four questions, with an annotated model outline.
Leave a Reply